Skip to main content
The Kontext sensor is in development. It is designed to observe supported tool calls in the local Claude Cowork virtual machine (VM) on a device running Claude Desktop. Cowork sessions hosted by Anthropic and activity on the host operating system are outside that scope. The initial package is designed for detection. It will record activity and policy results while tool calls continue. Deployment requires Anthropic approval and a Claude Desktop release that recognizes the Kontext signing key.

​
Planned data collection

The sensor is designed to report tool call activity from inside the VM to the deploying customer’s Kontext workspace. We will document which fields the package sends and how the workspace’s data collection settings apply to those fields before rollout. The sensor will retrieve policy and send reports over HTTPS on TCP port 443 to api.kontext.security, or to the Kontext API URL configured by the customer. It will authenticate with a customer-scoped install token that an admin can revoke in Kontext. Keep that token out of the Claude Desktop install arguments file, which is for identifiers.

​
Deploy and verify

Follow these steps once Anthropic approves the integration and Kontext supplies a signed package and vendor ID. Use a Claude Desktop release that includes that vendor ID and key and meets Anthropic’s platform requirements. Use the package for the VM’s CPU architecture: arm64 for Apple silicon Macs and Arm-based Windows PCs, x86_64 for Intel Macs and x64 Windows PCs.
  1. Copy the package and its detached signature, named as the package plus .sig, into one folder that ordinary users can’t write to, nor any folder above it. On Windows, use the system drive and no symbolic links or junctions on the path.
  2. Set coworkEDRIntegration to the full package path and coworkEDRIntegrationVendor to Kontext’s vendor ID, in lower case. On macOS, set both in an MDM profile. On Windows, set both as string values under HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Claude.
  3. Quit and reopen Claude Desktop. On Windows, quit with File → Exit.
When the local VM starts, Claude Desktop verifies the package and runs its installer. The sensor is designed to run as an unprivileged user without Linux capabilities or kernel modules. Deploy a new signed package to update it. Start a local Cowork session and run a harmless tool call, such as listing a directory. Find the session and tool call in Explore to verify reporting. If activity is missing, open the Claude Desktop diagnostic report and read cowork-edr-integration.txt. A run marked kind=installed means the installer exited without an error, not that the sensor is running. When the installer fails, the file shows the end of its output.

​
Stop future installs

Clear the coworkEDRIntegration setting through device management to stop future installs. An installed sensor requires a separate uninstall procedure. Previously reported activity remains in the workspace and follows your workspace’s retention and deletion process.